PHP2Shell: iziphoso ezimbili ezibucayi ze-PHP, ukuvinjelwa okuputshukile, nokuthi yini eyaziwayo mayelana nokuxhaphaza

Lokho okuhlanganiswa yile vidiyo

• Zombili iziphoso zilinganiselwe ku-9.2 ku-CVSS v4.0 yithimba le-PHP. Izinguqulo ezilungisiwe yi-PHP 8.2.35, 8.3.36, 8.4.27 kanye ne-8.5.12; i-PHP 7.4, 8.0 kanye ne-8.1 zithole ama-patch omthombo kuphela. I-PHP ithi ukubuyekeza ukuphela kwesisombululo esiphelele.
• Iphutha lokuqala livela ku-PHP ishiya isicelo singakakhiwa kahle lapho iphelelwa inkumbulo ngesikhathi esingafanele. Elesibili livela kumkhombi osele wenkumbulo yesicelo esisodwa ongasebenziswa isicelo esilandelayo kumsebenzi ofanayo. Ku-Apache ene-mod_php indlela yokuqala isebenza ngaphambi kwekhodi yohlelo lokusebenza.
• Umakhi oyinhloko we-PHP wathola izimpawu zokuqala zenkinga yenkumbulo ngesikhathi kuhlolwa ngo-2024. I-PHP Foundation ithi ukulungiswa okuphikisayo kwakunezinkinga futhi ithimba lezokuphepha elisekelwe ekuvumelaneni lalihlukumezeka ukukhetha, elikubiza ngokuthi ukwehluleka kwesakhiwo.
• I-Foundation ithi izinombolo ze-CVE zaputshuka ngo-Okthoba 20, i-Calif yashicilela ngengozi ividiyo ye-proof-of-concept, futhi i-Chainguard yashicilela izithombe ezakhiwe nge-fix ngaphezu kwamahora ayisithupha ngaphambi kokukhishwa. Umphathi we-Chainguard uthi abantu basebevele behlaselwa nokuthi wathola iziphoso ngokuzimela.
• Amakhompiyutha awavumelani mayelana nokuxhaphaza. I-Amazon yashicilela umzamo ngo-Okthoba 17 futhi kamuva yathi i-PHP2Shell yayixhaphazwa kabanzi. I-watchTowr yabika ukuxhaphazwa endle. I-CISA yayingakuboni ukuxhaphazwa ngesikhathi kushicilelwa, futhi ithimba le-PHP alitholanga ukuxhaphaza okusebenzayo ngesikhathi kukhishwa. Iningi lezifanekiso ze-proof-of-concept ezishicilelwe kubikwa ukuthi azisebenzi.
• Hlola zonke izindawo lapho i-PHP isebenza khona, okuhlanganisa namakhophi ngaphakathi kwezinye izofthiwe, buyekeza, qala kabusha abasebenzi futhi ubuyekeze izingodo kuze kufike ngo-Okthoba 17.

Umbhalo obhaliwe ohunyushwe

Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube.

Ubani ozame i-PHP2Shell ezinsukwini ezine ngaphambi kwesikhathi?

0:00 Ukuvinjelwa kwezokuphepha kufanele kugcine isiphoso sithule kuze kuphume i-patch. I-Amazon yashicilela umzamo wokulwa nesiphoso esibucayi se-PHP ezinsukwini ezine ngaphambi kwesikhathi. Kule vidiyo, ubani owakuthola? Uputshuke kanjani ukuvinjelwa? Futhi kubi kangakanani, ngempela? Futhi inkampani esolwa ngokuvuza inezivikelo engingazilindele. Ngizokufinyelela. KungoLwesine, Okthoba ngama-22, futhi lokhu yi-The Daily Diff.

0:21 I-PHP wulimi lokubhala olwakha amakhasi ewebhu kuseva ngaphambi nje kokuba akufinyelele. Iminyaka engaphezu kwamashumi amathathu ubudala futhi, ngokulinganisa okukodwa, isebenzisa amaphesenti angama-70 amawebhusayithi, okuhlanganisa ne-WordPress nesofthiwe ngemuva kwe-Wikipedia. Abathuthukisi bayathanda ukuyihleka usulu, ngokuvamile bephuma ekhasini i-PHP elibahlinzeka ngalo. Ukuyigcina kuyinzuzo engenzi nzuzo enonjiniyela abayishumi nantathu.

Ziyini iziphoso ezimbili ze-PHP2Shell?

0:41 NgoLwesithathu, i-PHP ikhiphe ukulungiswa okuphuthumayo ngeziphoso ezimbili ezibucayi ezivumela umuntu ongamazi ukuba asebenzise ikhodi kuseva ngaphandle kokungena ngemvume. Ngokubambisana zibizwa nge-PHP2Shell, futhi zibuyela emuva ku-PHP five point four. Nasi isiphoso sokuqala ngamagama alula. I-PHP inikeza isicelo ngasinye isabelomali senkumbulo. Uma isicelo sifinyelela leso sibalo ngesikhathi esingafanele, I-PHP iphuma ngokushesha bese ishiya isicelo singakakhiwa kahle. Bese isinyathelo sokuhlanza sithemba into engakakhiwa kahle.

1:07 Isiphoso sesibili siyasala. Iphutha elibi lingashiya inothi elikhomba inkumbulo eyayeyeyesicelo sokugcina. Umsebenzi ofanayo uphatha isicelo esilandelayo bese ulandela inothi. Ngaleso sikhathi omunye umuntu uhlala kulelo kheli. Ku-Apache ene-mod PHP, umonakalo wenzeka ngaphambi kokuba ikhodi yakho isebenze, ngakho ikhasi lakho lokungena alitholi i-vote. U-Wiz uthi ngisho ne-script ye-hello world ibonakalisiwe. Ukulungiswa kususa ukuphuma okuphuthumayo kwe-PHP ngenxa yokuphelelwa inkumbulo.

1:32 Esikhundleni sokuphuma phakathi nesicelo, i-PHP manje imisa kahle endaweni ephephile elandelayo. Ingxenye eyinqaba ukuthi iseluleko sokuqala sase sikhulile kangakanani.

Kungani isiphoso esaziwayo silinde iminyaka emibili?

1:39 Ngo-2024, ukuhlolwa kwezokuphepha kwangaphandle kwaholela umakhi oyinhloko we-PHP ezimpawini zokuqala zenkinga yenkumbulo. Ayikho i-exploit eyaziwayo, futhi konke ukulungiswa kwaphula okuthile. Ithimba elinquma ngokuvumelana lalingakwazi ukukhetha, ngakho isiphoso salinda. Bese ngo-Agasti, abatholi bafika ezinsukwini ezimbalwa.

Ubani owathola i-PHP2Shell, futhi kanjani?

1:56 Umshicileli we-Calif u-Ryan Austin wakuthola ngo-Agasti kuqala, esebenza ngohlelo lwe-OpenAI lwe-Patch the Planet. I-OpenAI yabika isizathu esifanayo ngokuzimele. U-Wiz wathola izinhlobo ezahlukene emasontweni ambalwa kamuva ngamamodeli we-Gemini ne-GPT. U-Austin uthi usebenzise amamodeli noma ubani angawathola, kanye nethiyori mayelana nalapho iziphoso ezindala ze-PHP zifihleke khona. I-OpenAI ithi i-AI yomngcele yayiyisihluthulelo. Isiphoso sase sifihleke iminyaka engaphezu kweshumi. Ukukhishwa kwakuhlelelwe uLwesine.

Uputshuke kanjani ukuvinjelwa kwe-PHP2Shell?

2:21 NgoLwesibili, izinombolo ezimbili ze-CVE zaqala ukusakazwa ku-inthanethi, ngesikhathi sokukhishwa esingalungile kanye nesikolo esingalungile seziyishumi. I-PHP ikhiphe ukukhishwa phambili ngosuku olulodwa. Ngaleso sakusihlwa, i-Calif yashicilela ngengozi ividiyo ye-proof of concept yayo isebenza, futhi amakhophi asinda ekususweni. NgoLwesithathu ekuseni, ngaphezu kwamahora ayisithupha ngaphambi kokukhishwa, I-Chainguard yashicilela izithombe ezakhiwe eziqukethe ukulungiswa. I-PHP ithi noma yimuphi umhlaseli angasifunda leso silungisiro ngenkathi bonke abanye belinde.

2:46 I-patch futhi iyi-diff, futhi abahlaseli bafunda ama-diff.

Ingabe i-PHP2Shell iyaxhaphazwa, futhi ngobani?

2:50 Ngubani-ke oqinisileyo ohlaselekile? I-honeypot ye-Amazon yashicilela umzamo ngo-Okthoba neshumi nesikhombisa futhi kamuva yathi I-PHP2Shell ixhaphazwa kabanzi. I-watchTowr ibika ukuxhaphazwa endle. I-Cisa ithi ayikuboni lapho ishicilelwe, futhi ithimba le-PHP aliboni ukuxhaphaza okusebenzayo ngesikhathi kukhishwa. Umphathi we-Cloudflare uthe wabona izinkulungwane zemizamo emahoreni ayishumi ngaphambi kokuba isimemezelo, nezigidi ngoLwesine ekuseni.

3:13 I-Amazon iqaphele ephuzwini elilodwa. Ayazi noma imizamo yayo yokuqala yayizosebenza yini ku-system yangempela. Umzamo uwukuqopha nje emnyango. Kubi kangakanani-ke, ngempela? I-watchTowr ithi izinhlelo zokuxhaphaza zomphakathi ezisakazekayo ikakhulu ziyaphahlazeka noma azikwenzi lutho. I-VulnCheck ithi ukukhipha ikhodi kusebenza kwezinye izilungiselelo, futhi ayikho kwezomphakathi ihlula ukuhlelwa okungahleliwe kwenkumbulo kumaseva ajwayelekile e-x86. Umshicileli u-Elias Taylor uthi akukude njengoba kulula njenge-Log4Shell.

3:40 Wonke umuntu usasho i-patch. Uhulumeni akazange alinde isahlulelo.

Yini uhulumeni ayikhiphe ku-inthanethi?

3:44 I-NSA yatshela izinhlangano ezingakwazi ukulungisa ukuthi zikhiphe izinhlelo ze-PHP ku-inthanethi, futhi i-National Cyber Security Centre yase-UK yanikeza iseluleko esifanayo. Amawebhusayithi ase-Dutch, okuhlanganisa nesevisi yezazisi zedijithali kazwelonke, ayeka ukusebenza, kanye newebhusayithi yamaphoyisa aseParis. I-Wikimedia ikhiphe izinhlelo eziningana njengesixwayiso. I-Palo Alto Networks ibale izikhathi ezingaphezu kweziyizigidi ezingamashumi amabili nambili ezidaluliwe. Futhi uprofesa wase-Australia wenze iphuzu elibukhali kakhulu. Amawebhusayithi okufanele ukhathazeke ngawo yilawo angakancishiswanga namuhla.

Yiziphi izinhlobo ze-PHP ezithola ukulungiswa?

4:11 Ukulungiswa kukhona nge-PHP eight point two kuya kweyisishiyagalombili point five. Nge-seven point four, eight point oh kanye ne-eight point one, I-PHP yashicilela ama-patch omthombo kuphela. Izinguqulo ezindala azitholi lutho kuphrojekthi ye-PHP, ngakho buza umthengisi wakho. Ama-workaround anciphisa amathuba, kodwa i-PHP ithi ukubuyekeza ukuphela kwendlela ephelele yokulungisa. Yisifundo esifanayo nesiqephu se-eMudhra sayizolo,

Wenzani nge-PHP2Shell kusihlwa?

4:32 ngoba ukuba khona kokulungiswa akufani nokuqhubeka kwenqubo ekukona. Thola zonke izinhlelo ze-PHP ku-stack yakho, ngisho namakhophi afihliwe ngaphakathi kwezinye izofthiwe. Buyekeza, qala kabusha abasebenzi, bese uhlola izingodo kuze kufike ngo-Okthoba neshumi nesikhombisa. Ngosuku olufanayo, i-GitLab ikhiphe i-patch release ebucayi,

Yini enye ekhiphe i-patch ebucayi ye-RCE namuhla?

4:47 ishumi nesishiyagalolunye point five point one. Ukugeleza kwenamba kumhlanganisi wayo wamagama ajwayelekile kuvumela umsebenzisi ongagunyaziwe ukuba asebenzise ikhodi kuseva, futhi ulinganisa ishumi kwayishumi. I-GitLab dot com isivele ilungisiwe. Ukufakwa okuzihambelayo kudinga ukubuyekezwa.

Kungani uMeta ayalwe ukukhokha u-$25 billion?

5:01 Ngaleso sikhathi eNew Mexico, ijaji layala i-Meta ukuthi ikhokhe u-$25 billion ezijezisini mayelana ne-Cambridge Analytica. Ijure labala ukwephulwa komthetho okungaphezu kwezigidi ezingamashumi amane nantathu kuze kufike ezinkulungwaneni ezinhlanu zamadola ngakunye, okwafinyelela cishe kumabhiliyoni angamakhulu amabili namashumi amabili ngaphambi kokuba ijaji liwakwehle. U-Meta uthi uzowina esicelweni. Manje ukuzivikela engikuthembisile.

Iyiphi indlela yokuzivikela ye-Chainguard yokulungisa ngaphambi kwesikhathi?

5:19 Umphathi we-Chainguard utshele i-The Register ukuthi wathola iziphoso ezifanayo yena ngoLwesihlanu ebusuku, ngemuva kokwazi ukuthi kukhona okuzayo ku-PHP, ngesikhuthazo esiyisisekelo sokuthola iziphazamiso ezimbi. Uthi ukhishwe ngaphambi kwesikhathi ngoba abantu basebevele behlaselwa. Uma ukhetha ukukufunda lokhu kunokuba ungizwe ngisho, i-diff ifika ebhokisini lakho leposi njalo ekuseni, mahhala ku-the daily diff dot dev, isixhumanisi ngezansi. Ngakho isahlulelo sanamuhla yi-SHIP IT.

Yini ethola isitembu se-SHIP IT?

5:39 Thumela isibuyekezo se-PHP kusihlwa, ngoba inombolo entsha yenguqulo iyona kuphela ephelele ukulungiswa. Futhi lokho yindaba yanamuhla. NginguNiko ovela ku-Axrisi. Hlanganisa ngokuzibophezela.

Imithombo

1. Today's PHP Security Release, and How We're Strengthening PHP SecurityThe PHP Foundation
2. RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)PHP security advisory
3. RCE via stale global state (GHSA-6wmf-4rv5-p3rp)PHP security advisory
4. Upcoming Critical PHP Security Releasephp.net
5. php2shellCalif
6. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the InternetWiz Research
7. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPotAWS Security Blog
8. Critical Vulnerabilities in PHP Require Immediate PatchingCISA
9. Flaw in PHP computer language leads to shutdown of websites around worldThe Guardian
10. What is PHP, and how bad is the computer language flaw causing website shutdowns globally?The Guardian
11. PHP2Shell Exploitation Started Days Before PatchesSecurityWeek
12. PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619Tanium
13. There isn't an easy exploit for this PHP vulnerabilityElias Taylor
14. PHP blames supply chain security biz Chainguard for putting entire web at riskThe Register
15. PHP2Shell: 22M exposed servers at risk as emergency patches releasedTechTarget
16. PHP ships emergency patches for critical PHP2Shell flawsBleepingComputer
17. GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13GitLab
18. Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica caseCNBC
19. Tell HN: 2x PHP RCE CVEs with CVSS 10.0 IncomingHacker News